CVE-2024-21888: ivanti connect secure

csirt@kutim:~/threat-intel/cve/CVE-2024-21888

CVSS 8.8 · High EPSS 85,4%

Kerentanan Improper Privilege Management pada ivanti connect secure. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.

Rincian

Terbit di NVD: 31 Januari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-269: Improper Privilege Management
EPSS (30 hari): 85,4% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ivanti	connect secure	Versi 9.0
ivanti	connect secure	Versi 9.0 r1
ivanti	connect secure	Versi 9.0 r2
ivanti	connect secure	Versi 9.0 r2.1
ivanti	connect secure	Versi 9.0 r3
ivanti	connect secure	Versi 9.0 r3.1
ivanti	connect secure	Versi 9.0 r3.2
ivanti	connect secure	Versi 9.0 r3.3
ivanti	connect secure	Versi 9.0 r3.5
ivanti	connect secure	Versi 9.0 r4
ivanti	connect secure	Versi 9.0 r4.1
ivanti	connect secure	Versi 9.0 r5.0
ivanti	connect secure	Versi 9.0 r6.0
ivanti	connect secure	Versi 9.1 r1
ivanti	connect secure	Versi 9.1 r10
ivanti	connect secure	Versi 9.1 r11
ivanti	connect secure	Versi 9.1 r11.3
ivanti	connect secure	Versi 9.1 r11.4
ivanti	connect secure	Versi 9.1 r11.5
ivanti	connect secure	Versi 9.1 r12
ivanti	connect secure	Versi 9.1 r12.1
ivanti	connect secure	Versi 9.1 r13
ivanti	connect secure	Versi 9.1 r13.1
ivanti	connect secure	Versi 9.1 r14
ivanti	connect secure	Versi 9.1 r15
ivanti	connect secure	Versi 9.1 r15.2
ivanti	connect secure	Versi 9.1 r16
ivanti	connect secure	Versi 9.1 r16.1
ivanti	connect secure	Versi 9.1 r17
ivanti	connect secure	Versi 9.1 r17.1
ivanti	connect secure	Versi 9.1 r18
ivanti	connect secure	Versi 9.1 r18.1
ivanti	connect secure	Versi 9.1 r18.2
ivanti	connect secure	Versi 9.1 r2
ivanti	connect secure	Versi 9.1 r3
ivanti	connect secure	Versi 9.1 r4
ivanti	connect secure	Versi 9.1 r4.1
ivanti	connect secure	Versi 9.1 r4.2
ivanti	connect secure	Versi 9.1 r4.3
ivanti	connect secure	Versi 9.1 r5
ivanti	connect secure	Versi 9.1 r6
ivanti	connect secure	Versi 9.1 r7
ivanti	connect secure	Versi 9.1 r8
ivanti	connect secure	Versi 9.1 r8.1
ivanti	connect secure	Versi 9.1 r8.2
ivanti	connect secure	Versi 9.1 r9
ivanti	connect secure	Versi 9.1 r9.1
ivanti	connect secure	Versi 21.9 r1
ivanti	connect secure	Versi 21.12 r1
ivanti	connect secure	Versi 22.1 r1
ivanti	connect secure	Versi 22.1 r6
ivanti	connect secure	Versi 22.2
ivanti	connect secure	Versi 22.2 r1
ivanti	connect secure	Versi 22.3 r1
ivanti	connect secure	Versi 22.4 r1
ivanti	connect secure	Versi 22.4 r2.1
ivanti	connect secure	Versi 22.6
ivanti	connect secure	Versi 22.6 r1
ivanti	connect secure	Versi 22.6 r2
ivanti	connect secure	Versi 22.6 r2.1

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 106 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-P... advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.